Apple's Face ID isn't that secure as it is. There have been numerous reports and testings that have shown Face ID being fooled by simple pictures and videos of a face, and even mask replicas of someone's face.
Currently their Face ID with a mask is going to work by using their TrueDepth camera to take a 3d model of your face AND you have to have an Apple watch series 3 or later connected and in proximity, to act as a 2nd factor of authentication. Sort of how "smart unlock" works on android, where if your phone is connected to a trusted device such as a car by Bluetooth, or a smart watch, the phone will remain unlocked as its in proximity. Apple is saying you must have an apple watch series 3 or later connected and in proximity AND then the face ID with mask will work.
Because with a mask on, you cut the available references points by over half, and so they need to compensate for this additional loss in security by adding an extra measure.
Expecting the Face ID alone with a mask on to be even close to as secure as without just isn't a real case scenario with the current hardware.
